summaryrefslogtreecommitdiff
path: root/drivers/infiniband/ulp/isert/ib_isert.c
diff options
context:
space:
mode:
authorSaravanan Vajravel <saravanan.vajravel@broadcom.com>2023-06-06 03:25:30 -0700
committerLeon Romanovsky <leon@kernel.org>2023-06-11 20:29:34 +0300
commit7651e2d6c5b359a28c2d4c904fec6608d1021ca8 (patch)
treeef94c2362153ba467e2ec596d7389da9033f31d1 /drivers/infiniband/ulp/isert/ib_isert.c
parent691b0480933f0ce88a81ed1d1a0aff340ff6293a (diff)
IB/isert: Fix possible list corruption in CMA handler
When ib_isert module receives connection error event, it is releasing the isert session and removes corresponding list node but it doesn't take appropriate mutex lock to remove the list node. This can lead to linked list corruption Fixes: bd3792205aae ("iser-target: Fix pending connections handling in target stack shutdown sequnce") Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com> Signed-off-by: Saravanan Vajravel <saravanan.vajravel@broadcom.com> Link: https://lore.kernel.org/r/20230606102531.162967-3-saravanan.vajravel@broadcom.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
Diffstat (limited to 'drivers/infiniband/ulp/isert/ib_isert.c')
-rw-r--r--drivers/infiniband/ulp/isert/ib_isert.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index b4809d237250..00a7303c8cc6 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -657,9 +657,13 @@ static int
isert_connect_error(struct rdma_cm_id *cma_id)
{
struct isert_conn *isert_conn = cma_id->qp->qp_context;
+ struct isert_np *isert_np = cma_id->context;
ib_drain_qp(isert_conn->qp);
+
+ mutex_lock(&isert_np->mutex);
list_del_init(&isert_conn->node);
+ mutex_unlock(&isert_np->mutex);
isert_conn->cm_id = NULL;
isert_put_conn(isert_conn);